eclipse jetty 9.4.37 vulnerabilities and exploits

(subscribe to this query)

For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-281...

Eclipse Jetty Netapp Snap Creator Framework -Netapp Solidfire -Netapp Hci Management Node -Netapp E-series Santricity Web Services -Netapp Snapcenter Plug-in -Netapp E-series Santricity Os Controller Netapp Element Plug-in For Vcenter Server -Oracle Autovue For Agile Product Lifecycle Management 21.0.2 Oracle Retail Eftlink 20.0.1 Oracle Communications Cloud Native Core Binding Support Function 1.10.0 Oracle Communications Diameter Signaling Router Oracle Communications Cloud Native Core Unified Data Repository 1.14.0 Oracle Communications Cloud Native Core Service Communication Proxy 1.14.0 Oracle Communications Cloud Native Core Security Edge Protection Proxy 1.5.0 Oracle Financial Services Crime And Compliance Management Studio 8.0.8.2.0 Oracle Financial Services Crime And Compliance Management Studio 8.0.8.3.0 Oracle Rest Data Services Oracle Stream Analytics Oracle Stream Analytics 19c

2 Github repositories

In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web....

2 Github repositories

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook